24 Oct 2017

Kubernetes

DRAFT

========== KUKU BERNADETTE =========

# Gestion certif

wget https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
chmod +x cfssl_linux-amd64
mv cfssl_linux-amd64 /usr/local/bin/cfssl
wget https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
chmod +x cfssljson_linux-amd64
mv cfssljson_linux-amd64 /usr/local/bin/cfssljson




mkdir /root/certs ; cd /root/certs


echo '{
  "signing": {
    "default": {
      "expiry": "8760h"
    },
    "profiles": {
      "kubernetes": {
        "usages": ["signing", "key encipherment", "server auth", "client auth"],
        "expiry": "8760h"
      }
    }
  }
}' > ca-config.json


echo '
{
  "CN": "jay-cluster",
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "FR",
      "L": "Paris",
      "O": "JayCorp",
      "OU": "IT",
      "ST": "IDF"
    }
  ]
}' > ca-csr.json


cfssl gencert -initca ca-csr.json | cfssljson -bare ca


echo '{
  "CN": "jay-cluster",
  "hosts": [
    "10.0.45.15",
    "10.0.45.28",
    "10.0.45.31",
    "jeb-test-3740.one.ippon-hosting.net",
    "jeb-test1-3741.one.ippon-hosting.net",
    "jeb-test2-3742.one.ippon-hosting.net",
    "jeb-test-3740",
    "jeb-test1-3741",
    "jeb-test2-3742",
    "localhost",
    "10.32.0.1",
    "127.0.1.1",
    "127.0.0.1"
  ],
  "key": {
    "algo": "rsa",
    "size": 2048
  },
  "names": [
    {
      "C": "FR",
      "L": "Paris",
      "O": "JayCorp",
      "OU": "IT",
      "ST": "IDF"
    }
  ]
}' > kubernetes-csr.json


cfssl gencert -ca=ca.pem -ca-key=ca-key.pem -config=ca-config.json -profile=kubernetes kubernetes-csr.json | cfssljson -bare kubernetes


scp *pem 10.0.45.28:/root/certs/
scp *pem 10.0.45.31:/root/certs/


# Etcd


https://github.com/coreos/etcd/releases/latest/


groupadd etcd
useradd etcd -d /var/lib/etcd -s /bin/false -g etcd
mkdir -p /var/lib/etcd
mkdir -p /etc/etcd/
cp /root/certs/ca.pem /root/certs/kubernetes-key.pem /root/certs/kubernetes.pem /etc/etcd/
chown etcd:etcd /var/lib/etcd -R
chown etcd:etcd /etc/etcd -R




wget https://github.com/coreos/etcd/releases/download/v3.2.9/etcd-v3.2.9-linux-amd64.tar.gz 

tar -xvf etcd-v3.2.9-linux-amd64.tar.gz
mv etcd-v3.2.9-linux-amd64/etcd* /usr/local/bin/



echo '[Unit]
Description=etcd
Documentation=https://github.com/coreos

[Service]
User=etcd
ExecStart=/usr/local/bin/etcd --name jeb-test-3740 \
  --cert-file=/etc/etcd/kubernetes.pem \
  --key-file=/etc/etcd/kubernetes-key.pem \
  --peer-cert-file=/etc/etcd/kubernetes.pem \
  --peer-key-file=/etc/etcd/kubernetes-key.pem \
  --trusted-ca-file=/etc/etcd/ca.pem \
  --peer-trusted-ca-file=/etc/etcd/ca.pem \
  --initial-advertise-peer-urls https://10.0.45.15:2380 \
  --listen-peer-urls https://10.0.45.15:2380 \
  --listen-client-urls https://10.0.45.15:2379,http://127.0.0.1:2379 \
  --advertise-client-urls https://10.0.45.15:2379 \
  --initial-cluster-token etcd-jay-cluster \
  --initial-cluster jeb-test-3740=https://10.0.45.15:2380,jeb-test1-3741=https://10.0.45.28:2380,jeb-test2-3742=https://10.0.45.31:2380 \
  --initial-cluster-state new \
  --data-dir=/var/lib/etcd
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target' > etcd.service

mv etcd.service /lib/systemd/system/

systemctl daemon-reload
systemctl enable etcd
systemctl start etcd


etcdctl --ca-file=/etc/etcd/ca.pem cluster-health



# Flanneld
https://github.com/coreos/flannel/releases/


etcdctl --ca-file=/etc/etcd/ca.pem set /flanneld/network/config '{ "Network": "10.32.0.0/16" }'                                                                                                                    


wget https://github.com/coreos/flannel/releases/download/v0.9.0/flannel-v0.9.0-linux-amd64.tar.gz
tar -zxpvf flannel-v0.9.0-linux-amd64.tar.gz 
mv flanneld /usr/local/bin/
mkdir -p /var/lib/kubernetes/flannel/networks

echo '[Unit]
Description=Network fabric for containers
Documentation=https://github.com/coreos/flannel
After=etcd.service

[Service]
Type=notify
Restart=always
RestartSec=5
ExecStart=/usr/local/bin/flanneld \
  -etcd-endpoints=https://10.0.45.15:2379 \
  -etcd-keyfile=/etc/etcd/kubernetes-key.pem \
  -etcd-certfile=/etc/etcd/kubernetes.pem \
  -etcd-cafile=/etc/etcd/ca.pem \
  -etcd-prefix=/flanneld/network \
  -subnet-file=/var/lib/kubernetes/flannel/subnet.env
[Install]
WantedBy=multi-user.target' > /lib/systemd/system/flanneld.service


systemctl daemon-reload
systemctl enable flanneld
systemctl start flanneld


# Install docker

apt-get update && apt-get install -y curl apt-transport-https
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
cat <<EOF >/etc/apt/sources.list.d/docker.list
deb https://download.docker.com/linux/$(lsb_release -si | tr '[:upper:]' '[:lower:]') $(lsb_release -cs) stable
EOF
apt-get update && apt-get install -y docker-ce


echo '[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target docker.socket firewalld.service flanneld.service
Wants=network-online.target
Requires=docker.socket

[Service]
Type=notify

EnvironmentFile=-/var/lib/kubernetes/flannel/subnet.env
ExecStart=/usr/bin/dockerd -H fd:// --bip=${FLANNEL_SUBNET} --mtu=${FLANNEL_MTU}
ExecReload=/bin/kill -s HUP $MAINPID
LimitNOFILE=1048576
LimitNPROC=infinity
LimitCORE=infinity
TasksMax=infinity
TimeoutStartSec=0
Delegate=yes
KillMode=process
Restart=on-failure
StartLimitBurst=3
StartLimitInterval=60s

[Install]
WantedBy=multi-user.target' > /lib/systemd/system/docker.service

systemctl daemon-reload
systemctl enable docker
systemctl start docker


# Kubernetes


groupadd kube 
useradd kube -g kube -d /var/lib/kubernetes/ -s /bin/false
gpasswd -a kube docker

https://github.com/kubernetes/kubernetes/releases/


mkdir -p /var/lib/kubernetes
cp /root/certs/ca.pem /root/certs/kubernetes-key.pem /root/certs/kubernetes.pem /var/lib/kubernetes/
chown -R kube:kube /var/lib/kubernetes


wget https://storage.googleapis.com/kubernetes-release/release/v1.7.8/bin/linux/amd64/kube-apiserver
wget https://storage.googleapis.com/kubernetes-release/release/v1.7.8/bin/linux/amd64/kube-controller-manager
wget https://storage.googleapis.com/kubernetes-release/release/v1.7.8/bin/linux/amd64/kube-scheduler
wget https://storage.googleapis.com/kubernetes-release/release/v1.7.8/bin/linux/amd64/kubectl
wget https://storage.googleapis.com/kubernetes-release/release/v1.7.8/bin/linux/amd64/kubelet
wget https://storage.googleapis.com/kubernetes-release/release/v1.7.8/bin/linux/amd64/kube-proxy

chmod +x kube-apiserver kube-controller-manager kube-scheduler kubectl kube-proxy kubelet

mv kube-apiserver kube-controller-manager kube-scheduler kubectl kube-proxy kubelet /usr/local/bin/



echo '[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
User=kube
ExecStart=/usr/local/bin/kube-apiserver \
  --admission-control=NamespaceLifecycle,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota \
  --advertise-address=10.0.45.15 \
  --service-node-port-range=30000-32767 \
  --allow-privileged=true \
  --enable-swagger-ui=true \
  --apiserver-count=3 \
  --authorization-mode=ABAC,RBAC \
  --authorization-policy-file=/var/lib/kubernetes/authorization-policy.jsonl \
  --bind-address=0.0.0.0 \
  --insecure-bind-address=0.0.0.0 \
  --service-cluster-ip-range=10.32.0.0/16 \
  --kubelet-certificate-authority=/var/lib/kubernetes/ca.pem \
  --kubelet-client-certificate=/var/lib/kubernetes/kubernetes.pem \
  --kubelet-client-key=/var/lib/kubernetes/kubernetes-key.pem \
  --service-account-key-file=/var/lib/kubernetes/kubernetes-key.pem \
  --tls-cert-file=/var/lib/kubernetes/kubernetes.pem \
  --tls-private-key-file=/var/lib/kubernetes/kubernetes-key.pem \
  --tls-ca-file=/var/lib/kubernetes/ca.pem \
  --token-auth-file=/var/lib/kubernetes/token.csv \
  --etcd-servers=https://10.0.45.15:2379,https://10.0.45.28:2379,https://10.0.45.31:2379 \
  --etcd-certfile=/var/lib/kubernetes/kubernetes.pem \
  --etcd-keyfile=/var/lib/kubernetes/kubernetes-key.pem \
  --etcd-cafile=/var/lib/kubernetes/ca.pem \
  --storage-backend=etcd2 \
  --storage-media-type=application/json \
  --v=2 
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target' > kube-apiserver.service


mv kube-apiserver.service /lib/systemd/system/
systemctl daemon-reload
systemctl enable kube-apiserver





echo '[Unit]
Description=Kubernetes Controller Manager
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
User=kube
ExecStart=/usr/local/bin/kube-controller-manager \
  --allocate-node-cidrs=true \
  --cluster-cidr=10.0.45.0/24 \
  --cluster-name=jay-cluster \
  --leader-elect=true \
  --master=http://10.0.45.15:8080 \
  --root-ca-file=/var/lib/kubernetes/ca.pem \
  --service-account-private-key-file=/var/lib/kubernetes/kubernetes-key.pem \
  --service-cluster-ip-range=10.32.0.0/16 \
  --v=2
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target' > kube-controller-manager.service



mv kube-controller-manager.service /lib/systemd/system/
systemctl daemon-reload
systemctl enable kube-controller-manager





echo '[Unit]
Description=Kubernetes Scheduler
Documentation=https://github.com/GoogleCloudPlatform/kubernetes

[Service]
User=kube
ExecStart=/usr/local/bin/kube-scheduler \
  --leader-elect=true \
  --master=http://10.0.45.15:8080 \
  --v=2
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target' > kube-scheduler.service



mv kube-scheduler.service /lib/systemd/system/
systemctl daemon-reload
systemctl enable kube-scheduler


date +%s | sha256sum | base64 | head -c 32 ; echo


echo 'MGY1ZTE1NTQyZjJjOTYzNjU4ZTJiZThj,admin,admin
YzRlMWUwOGE2YjM0ZWRlN2UyNWNiODc3,kubelet,kubelet' > /var/lib/kubernetes/token.csv

echo '{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"*", "nonResourcePath": "*", "readonly": true}}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"admin", "namespace": "*", "resource": "*", "apiGroup": "*"}}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"scheduler", "namespace": "*", "resource": "*", "apiGroup": "*"}}
{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group":"system:serviceaccounts", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}}' > /var/lib/kubernetes/authorization-policy.jsonl


chown -R kube:kube /var/lib/kubernetes/*




systemctl start kube-apiserver
systemctl start kube-controller-manager
systemctl start kube-scheduler

kubectl get componentstatuses







# Kube worker





mkdir -p /var/lib/kubernetes


echo '[Unit]
Description=Kubernetes Kubelet
Documentation=https://github.com/GoogleCloudPlatform/kubernetes
After=docker.service flanneld.service
Requires=docker.service

[Service]
ExecStart=/usr/local/bin/kubelet \
  --allow-privileged=true \
  --api-servers=https://10.0.45.15:6443,https://10.0.45.28:6443,https://10.0.45.31:6443 \
  --cloud-provider= \
  --cluster-dns=10.32.0.10 \
  --cluster-domain=jaycorp \
  --container-runtime=docker \
  --docker=unix:///var/run/docker.sock \
  --require-kubeconfig \
  --kubeconfig=/var/lib/kubernetes/kubeconfig \
  --client-ca-file=/var/lib/kubernetes/ca.pem \
  --serialize-image-pulls=false \
  --tls-cert-file=/var/lib/kubernetes/kubernetes.pem \
  --tls-private-key-file=/var/lib/kubernetes/kubernetes-key.pem \
  --cpu-cfs-quota=false \
  --logtostderr=true \
  --port=10250 \
  --address=0.0.0.0 \
  --pod-cidr=10.32.0.0/16 \
  --chaos-chance=0.0 \
  --v=2
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target' > /lib/systemd/system/kubelet.service


systemctl daemon-reload
systemctl enable kubelet





echo '[Unit]
Description=Kubernetes Proxy
Documentation=https://github.com/kubernetes/kubernetes
After=flanneld.service

[Service]
User=root
ExecStart=/usr/local/bin/kube-proxy \
  --master=http://10.0.45.15:8080 \
  --logtostderr=true
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target' > /lib/systemd/system/kube-proxy.service


systemctl daemon-reload
systemctl enable kube-proxy







kubectl config set-credentials admin --token='MGY1ZTE1NTQyZjJjOTYzNjU4ZTJiZThj' --cluster='jay-cluster' --user='admin' --server='https://10.0.45.15:6443' 

kubectl config set-credentials admin --cluster='jay-cluste'r --client-certificate='/var/lib/kubernetes/kubernetes.pem'  --client-key='/var/lib/kubernetes/kubernetes-key.pem' --certificate-authority='/var/lib/kubernetes/ca.pem' --server='https://10.0.45.15:6443'       

kubectl config set-cluster jay-cluster --certificate-authority='/var/lib/kubernetes/ca.pem' --embed-certs=true --server='https://10.0.45.15:6443'

kubectl config set-context admin --cluster=jay-cluster --user=admin --server=https://10.0.45.15:6443      

kubectl config use-context admin







echo "apiVersion: v1
clusters:
- cluster:
`grep certificate-authority-data /root/.kube/config`
    server: https://10.0.45.15:6443
  name: jay-cluster
contexts:
- context:
    cluster: jay-cluster
    user: admin
  name: admin
current-context: admin
kind: Config
preferences: {}
users:
- name: admin
  user:
    token: MGY1ZTE1NTQyZjJjOTYzNjU4ZTJiZThj" > /var/lib/kubernetes/kubeconfig


chown -R kube: /var/lib/kubernetes


systemctl start kubelet
systemctl start kube-proxy


kubectl get nodes

=======TIPS===========

kubectl taint nodes –all node-role.kubernetes.io/master-

etcdctl –ca-file=/etc/etcd/ca.pem cluster-health

kubectl proxy –address=’0.0.0.0’ –port=8001 –accept-hosts=’^*$’

kubectl config view

kubectl get componentstatuses

kubectl get pods –all-namespaces –show-all
kubectl get deployment –all-namespaces –show-all
kubectl get service –all-namespaces
kubectl get nodes

kubectl cluster-info

kubectl get events –namespace=kube-system

kubectl drain –delete-local-data –force –ignore-daemonsets
kubectl delete node –namespace=kube-system

source <(kubectl completion bash)

kubectl logs pod/skydns-352548417-bg8r5 skydns –namespace=kube-system

curl http://127.0.0.1:4194/validate/

curl 10.0.45.15:8080/healthz

kubectl cp /tmp/foo /:/tmp/bar

=============================================

Informatique

kubernetes